Hi team,
Okay, so what we have observed in our network is that flow-export sometimes causes high interface utilization and as a workaround, we remove and re-add flow export commands. Now there are short burstd of traffic as well, so I want to add a condition where "burst happens 3 times in 60s, then trigger the event". As I cannot test in production router, so I am testing on a lab switch and there is not much traffic on it. txload/rxload is 1 and hence my applet looks like this:
sw1-trn-mr3.hyd.shaw.net#sh run | b event manager
event manager applet test authorization bypass
event tag 1 interface name GigabitEthernet0/4 parameter txload entry-op ge entry-val 1 entry-type value exit-op lt exit-val 1 exit-type value poll-interval 10
event tag 2 interface name GigabitEthernet0/4 parameter rxload entry-op ge entry-val 1 entry-type value exit-op lt exit-val 1 exit-type value poll-interval 10
trigger occurs 3 period 60
correlate event 1 or event 2
action 1.1 cli command "enable"
action 1.2 syslog msg "Interface utilization has risen again. "
action 1.3 cli command "show proc cpu | append flash:test"
action 1.4 cli command "show interface GigabitEthernet0/4 | append flash:test"
action 1.6 cli command "show ip cache flow | append flash:test"
action 1.7 cli command "show tech | append flash:test"
action 2.2 cli command "no ip flow-export source GigabitEthernet0/4"
action 2.3 cli command "no ip flow-export destination 192.168.1.1 2055"
action 2.5 cli command "ip flow-export source GigabitEthernet0/4"
action 2.6 cli command "ip flow-export destination 192.168.1.1 2055"
action 2.9 cli command "end"
!
end
The thing is it does not work. I turned on debugs and I see this.
Mar 3 15:30:46: fh_send_intf_fd_msg: msg_type=114
Mar 3 15:30:46: fh_send_intf_fd_msg: sval=0
Mar 3 15:30:46: fh_send_intf_fd_msg: msg_type=114
Mar 3 15:30:46: fh_send_intf_fd_msg: sval=0
Mar 3 15:30:54: fh_fd_intf_process_async
Mar 3 15:30:54: fh_fd_intf_param_fetch:I/F=GigabitEthernet0/4 txload=1
Mar 3 15:30:54: intf_value_uint_compare:op1=1 op2=1 ret=TRUE
Mar 3 15:30:54: intf_entry_value_check:Returning TRUE
Mar 3 15:30:54: fh_fd_intf_event_match: re = 0x5849AA0, num_matches = 1
Mar 3 15:30:54: fh_fd_intf_start_poll_timer: start_t=10000
Mar 3 15:30:54: fh_fd_intf_process_poll_timer: update_t=0
Mar 3 15:30:54: fh_fd_intf_param_fetch:I/F=GigabitEthernet0/4 rxload=1
Mar 3 15:30:54: intf_value_uint_compare:op1=1 op2=1 ret=TRUE
Mar 3 15:30:54: intf_entry_value_check:Returning TRUE
Mar 3 15:30:54: fh_fd_intf_event_match: re = 0x56D793C, num_matches = 1
Mar 3 15:30:54: fh_fd_intf_start_poll_timer: start_t=10000
Mar 3 15:30:54: fh_fd_intf_process_poll_timer: update_t=0
Mar 3 15:30:54: fh_send_intf_fd_msg: msg_type=64
Mar 3 15:30:54: fh_send_intf_fd_msg: sval=63
Mar 3 15:30:54: fh_send_intf_fd_msg: msg_type=64
Mar 3 15:30:54: fh_send_intf_fd_msg: sval=0
Mar 3 15:31:04: fh_fd_intf_process_async
Mar 3 15:31:04: fh_fd_intf_param_fetch:I/F=GigabitEthernet0/4 txload=1
Mar 3 15:31:04: intf_value_uint_compare:op1=1 op2=1 ret=FALSE
Mar 3 15:31:04: intf_exit_value_check: re=0x5849AA0, returning=FALSE
Mar 3 15:31:04: intf_exit_comb_check:Returning FALSE
Mar 3 15:31:04: fh_fd_intf_event_match: re = 0x5849AA0, num_matches = 0
Mar 3 15:31:04: fh_fd_intf_start_poll_timer: start_t=10000
Mar 3 15:31:04: fh_fd_intf_process_poll_timer: update_t=0
Mar 3 15:31:04: fh_fd_intf_param_fetch:I/F=GigabitEthernet0/4 rxload=1
Mar 3 15:31:04: intf_value_uint_compare:op1=1 op2=1 ret=FALSE
Mar 3 15:31:04: intf_exit_value_check: re=0x56D793C, returning=FALSE
Mar 3 15:31:04: intf_exit_comb_check:Returning FALSE
Mar 3 15:31:04: fh_fd_intf_event_match: re = 0x56D793C, num_matches = 0
Only the first time, it returns TRUE. After that, it returns FALSE always and hence the condition "trigger occurs 3 period 60" does not match and hence no event is triggered. Where am I going wrong?
Appreciate your help on this.
Thanks.
